﻿// SuperKernelHackingClentDemo.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//

#include <iostream>
#include<windows.h>
#include <winioctl.h>

#define DEVICE_NAME  L"\\Device\\SuperKernelHacking"
#define LINK_NAME    L"\\??\\SuperKernelHacking"

#define  BASE_CODE  0x800

#define GET_PROCESS_LIST CTL_CODE(FILE_DEVICE_UNKNOWN, BASE_CODE + 0X100, METHOD_IN_DIRECT, FILE_ANY_ACCESS)


typedef struct _SkProcessChain
{
	/*进程PID*/
	ULONG64 UniqueProcessId;

	/*父进程PID*/
	ULONG64 InheritedFromUniqueProcessId;

	/*进程EPROCESS*/
	ULONG64 Eprocess;

	/*进程名*/
	PVOID ImageFileName;

	/*进程路径*/
	PVOID ImageFilePath;

	/*创建时间*/
	LONG64 CreateTime;

	/*隐藏进程*/
	ULONG64 IsHideProcess;

	struct _SkProcessChain *Next;
}SkProcessChain, *PSkProcessChain;

class Drv
{
public:
	Drv();
public:
	PVOID GetProcessList();
private:
	HANDLE m_DeviceHandle;
};


int main()
{
	Drv Test;
	PSkProcessChain ProcessList = (PSkProcessChain)Test.GetProcessList();
	while (ProcessList != NULL)
	{
		printf("CreateTime = %p\n", ProcessList->CreateTime);
		printf("EPROCESS = %p\n", ProcessList->Eprocess);
		printf("ImageFileName = %ws\n", ProcessList->ImageFileName);
		printf("ImageFilePath = %ws\n", ProcessList->ImageFilePath);
		printf("InheritedFromUniqueProcessId = %d\n", ProcessList->InheritedFromUniqueProcessId);
		printf("Hide = %d\n", ProcessList->IsHideProcess);
		printf("UniqueProcessId = %d\n", ProcessList->UniqueProcessId);
		printf("-------------------------\n");
		ProcessList = ProcessList->Next;
	}

	while (1) Sleep(1000);
}

Drv::Drv()
{
	m_DeviceHandle = CreateFileW(LINK_NAME,
		GENERIC_READ | GENERIC_WRITE,
		0,
		NULL,
		OPEN_EXISTING,
		0,
		NULL
	);

	if (m_DeviceHandle == INVALID_HANDLE_VALUE)
	{
		MessageBoxA(0, "加载驱动失败\n", "OAA_AM_SB", 0);
		exit(0);
	}
}

PVOID Drv::GetProcessList()
{
	/*返回的是一个指针存放在Info里所以这里要传入info的地址*/
	ULONG64 Info = 0;
	ULONG64 Buffer = (ULONG64)&Info;
	DWORD   dwRet = 0;
	BOOL Status = DeviceIoControl(m_DeviceHandle,
		GET_PROCESS_LIST,
		&Buffer,
		sizeof(ULONG64),
		NULL,
		NULL,
		&dwRet,
		NULL
	);
	return (PVOID)Info;
}
